Nearly 59% of all plugins hosted on the official WordPress.org directory are considered abandoned or functionally unmaintained, and the risk that creates is compounding: 46% of newly disclosed vulnerabilities in 2025 had no developer patch available at the moment they were publicly disclosed, up sharply from 33% the year before. An abandoned plugin with a disclosed vulnerability isn’t a problem waiting to be fixed — for a real share of them, no fix is coming at all.
The Scale of the Underlying Problem
11,334 new vulnerabilities were disclosed across the WordPress ecosystem in 2025 alone — a 42% jump from 2024’s 7,966, and the highest total ever recorded. 91% of these were in plugins, versus just 9% in themes and six low-severity issues in WordPress core itself. The plugin layer is overwhelmingly where the actual risk concentrates, and abandonment is a large part of why that risk doesn’t get resolved.
Why WordPress.org Started Removing Plugins
1,614 abandoned plugins were systematically removed from the official repository specifically to protect end users from opportunistic exploitation — a meaningful acknowledgment that leaving known-abandoned software available for install was itself a risk, not a neutral inconvenience. Removal from the directory doesn’t retroactively fix an install already running the abandoned plugin, though; it only stops new installs.
The Highest-Risk Categories
| Category | Why it’s high-risk |
|---|---|
| Page builders | Deep integration with theme/content rendering, broad attack surface, high install counts |
| WooCommerce extensions | Direct access to payment, customer, and order data |
| Membership / LMS plugins | Access control logic is a high-value target if compromised |
| Marketing / popup plugins | Often installed for a narrow purpose, then forgotten and rarely revisited |
All four categories sit at a Plugin Vulnerability Risk (PVR) score of 70+ and together account for the majority of real-world WordPress hacks seen in incident response.
What to Actually Do
- Audit your plugin list for last-updated dates — a plugin untouched for a year or more, especially in one of the four high-risk categories, deserves specific scrutiny, not a routine glance.
- Check whether the plugin has been removed from the WordPress.org directory — if it has and you’re still running it, that’s a strong signal to replace it, not just watch it.
- For anything abandoned in a high-risk category, replace it proactively rather than waiting for a disclosed vulnerability — given the 46% no-patch-available rate, waiting for a fix that may never arrive is a real gamble, not caution.
- Prioritize replacing plugins touching payments, customer data, or access control first if you can’t audit everything at once — that’s where impact is highest if something does go wrong.
This connects directly to How to Audit WordPress Plugins Safely and Plugin Bloat vs Performance: What to Keep and What to Remove. Want your site’s plugin list audited for abandonment risk? Get in touch.
Frequently Asked Questions
How do I check if a plugin is actually abandoned?
Check its “last updated” date and changelog activity on the WordPress.org plugin page — a plugin with no updates in over a year, especially with open support-forum questions going unanswered, is a strong abandonment signal.
Is an abandoned plugin automatically dangerous, even without a disclosed vulnerability?
Not automatically, but the risk compounds over time — no active maintainer means no one is looking for or fixing issues, and given nearly half of new vulnerabilities go unpatched at disclosure, an abandoned plugin’s odds of ever being fixed if something is found are poor.
Does WordPress.org removing a plugin protect sites already running it?
No — removal only prevents new installs from the directory. A site already running the plugin keeps running it until the site owner actively replaces or removes it.
Featured image: original illustration.